feat(ci): ajouter validation et garde-fou de déploiement

server/azureAuth.test.ts

@@ -1,21 +1,47 @@
-import { describe, it, expect } from "vitest";
-import { isAzureAdConfigured, getAzureAuthUrl } from "./azureAuth";
+import { afterAll, beforeEach, describe, expect, it, vi } from "vitest";
+
+const azureTestConfig = {
+  tenantId: "00000000-0000-0000-0000-000000000001",
+  clientId: "00000000-0000-0000-0000-000000000002",
+  clientSecret: "test-secret-not-used-for-url",
+};
+
+const originalAzureEnv = {
+  tenantId: process.env.AZURE_AD_TENANT_ID,
+  clientId: process.env.AZURE_AD_CLIENT_ID,
+  clientSecret: process.env.AZURE_AD_CLIENT_SECRET,
+  redirectUri: process.env.AZURE_AD_REDIRECT_URI,
+};
 
 describe("Azure AD configuration", () => {
-  it("should detect Azure AD as configured when env vars are set", () => {
-    // Les variables sont injectées via webdev_request_secrets
+  beforeEach(() => {
+    // Chaque test utilise une instance MSAL neuve et ne dépend jamais des secrets CI.
+    vi.resetModules();
+    process.env.AZURE_AD_TENANT_ID = azureTestConfig.tenantId;
+    process.env.AZURE_AD_CLIENT_ID = azureTestConfig.clientId;
+    process.env.AZURE_AD_CLIENT_SECRET = azureTestConfig.clientSecret;
+    process.env.AZURE_AD_REDIRECT_URI = "https://example.test/api/auth/azure/callback";
+  });
+
+  afterAll(() => {
+    process.env.AZURE_AD_TENANT_ID = originalAzureEnv.tenantId;
+    process.env.AZURE_AD_CLIENT_ID = originalAzureEnv.clientId;
+    process.env.AZURE_AD_CLIENT_SECRET = originalAzureEnv.clientSecret;
+    process.env.AZURE_AD_REDIRECT_URI = originalAzureEnv.redirectUri;
+  });
+
+  it("détecte Azure AD lorsqu’une configuration complète est fournie", async () => {
+    const { isAzureAdConfigured } = await import("./azureAuth");
     const configured = isAzureAdConfigured();
     expect(configured).toBe(true);
   });
 
-  it("should generate a valid Azure AD auth URL", async () => {
-    if (!isAzureAdConfigured()) {
-      console.warn("Azure AD not configured, skipping URL test");
-      return;
-    }
+  it("génère une URL d’autorisation Azure AD à partir de la configuration de test", async () => {
+    const { getAzureAuthUrl } = await import("./azureAuth");
     const url = await getAzureAuthUrl();
     expect(url).toContain("login.microsoftonline.com");
     expect(url).toContain("oauth2/v2.0/authorize");
-    expect(url).toContain("f496da82-e18f-4567-bf05-8551ae6669b2"); // client_id
+    expect(url).toContain(azureTestConfig.tenantId);
+    expect(url).toContain(azureTestConfig.clientId);
   });
 });